CVE-2026-115242 in WPvivid Plugin
Summary
by MITRE • 11/04/2026
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in versions of the WPvivid Backup, Migration & Staging plugin prior to version 0.9.137 represents a critical path traversal flaw within its staging functionality. This security defect stems from an inconsistency in how input validation is applied across different handlers within the same feature set. Specifically, while the handler responsible for checking file writability correctly implements filename sanitization, the primary handler that initiates the staging process fails to adequately sanitize the destination folder parameter provided by the user. The plugin relies on a generic text filter rather than robust path normalization or strict validation rules when processing this input. This architectural oversight allows an attacker who has obtained authenticated administrator credentials to manipulate the file system structure of the target WordPress installation significantly beyond intended boundaries.
From a technical perspective, the core issue lies in the lack of proper canonicalization and boundary enforcement for directory paths. When an administrator supplies a staging destination path containing traversal sequences such as dot-dot-slash characters, the application processes these inputs without stripping or rejecting them appropriately. Consequently, when the plugin attempts to copy site files to this location, it writes data outside the designated WordPress installation root directory. This behavior violates the principle of least privilege and proper sandboxing expected in web applications, allowing for arbitrary file write operations in locations accessible by the web server process. The discrepancy between the sanitization logic used in the writability check versus the actual copy operation creates a predictable attack vector that can be exploited reliably given valid administrative access.
The operational impact of this vulnerability is severe due to its potential to lead to remote code execution and complete site compromise. By writing files outside the WordPress directory, an attacker can place malicious scripts in directories with broader write permissions or execute them if they reside within a publicly accessible path that allows script interpretation by the web server. This capability enables the persistence of backdoors, theft of sensitive data stored elsewhere on the filesystem, and further lateral movement across the hosting environment. Since exploitation requires authenticated administrator access, it is often associated with insider threats, compromised credentials from credential stuffing attacks, or privilege escalation following a lower-level vulnerability discovery. The ability to write arbitrary files anywhere accessible by the web server process fundamentally undermines the integrity of the entire application stack.
Industry standards classify this type of flaw under CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-94: Improper Control of Generation of Code (Code Injection). In terms of tactical mapping, this vulnerability aligns with MITRE ATT&CK techniques related to File and Directory Discovery as well as Command and Scripting Interpreter execution via uploaded files. The inconsistency in input validation highlights the importance of centralized security middleware or consistent sanitization libraries across all entry points within a plugin module.
To mitigate this risk, immediate action is required by upgrading the WPvivid Backup, Migration & Staging plugin to version 0.9.137 or later where these path traversal issues have been addressed through rigorous input validation and output encoding practices. Administrators should also enforce strict file permission settings on their WordPress directories, ensuring that only necessary paths are writable by the web server process. Implementing a Web Application Firewall with rules specifically targeting directory traversal patterns can provide an additional layer of defense against exploitation attempts. Regular auditing of plugin code for consistent input handling across all handlers is recommended to prevent similar discrepancies in future updates or other third-party extensions.